Skip to main content
Cisco XDR is a detection, investigation, and response platform that unifies telemetry, threat intelligence, and automated response across a security team’s environment. With this integration, Cisco XDR queries the Pulsedive API directly during an investigation, so indicators, threats, and feeds you search in Cisco XDR come back enriched with Pulsedive’s risk scores and context. Because Cisco XDR calls Pulsedive on demand, there is no data to poll or ingest ahead of time; every investigation reflects Pulsedive’s current data.

Prerequisites

Before you connect Cisco XDR to Pulsedive, make sure you have:
  • A Pulsedive account and API key. Find your API key on your Pulsedive account page. A free account is enough to use this integration.
  • A Cisco XDR account with permission to manage third-party integrations. Pulsedive is a threat intelligence integration, included with the Cisco XDR Essentials license and every higher tier, so no additional license is required.

Connecting Cisco XDR to Pulsedive

Follow these steps to add Pulsedive as a third-party integration in Cisco XDR, so it starts returning Pulsedive data the next time you run an investigation:
  1. In the Cisco XDR navigation menu, go to Administration > Integrations.
  2. On the Integrations page, select the Third-Party tab and find the Pulsedive integration card.
  3. Select the plus sign (+) in the lower-right corner of the card.
  4. Expand the Integration Guide area on the Pulsedive integration page and follow the in-app instructions to enter your Pulsedive API key.

Verifying the Connection

Confirm that Cisco XDR is returning Pulsedive data before you rely on it in an investigation.
  1. Start a new investigation using an indicator you know Pulsedive has data on.
  2. Check the investigation results for Pulsedive as a source.

Using Pulsedive Data in Cisco XDR

Once connected, Cisco XDR enriches investigations with Pulsedive data automatically, so analysts get Pulsedive’s risk scores and context in the same view as everything else, without a separate lookup. You can:
  • Investigate an IP address, IPv6 address, domain, or URL. Results include Pulsedive’s risk score and risk factors, source feeds, associated threats, WHOIS, DNS records, HTTP headers, SSL metadata, ports, redirects, query strings, cookies, and mail servers.
  • Investigate a threat to pull its related news, comments, risky properties, source feeds, and indicators.
  • Investigate a feed to pull its name, organization, threats, and indicators.
To learn more about investigations in Cisco XDR, visit Cisco’s Investigate documentation.